add sudoers allowlist for ops user automation

Passwordless sudo access scoped to specific commands (dnf, systemctl, firewall-cmd, ansible, qemu/virt, btrfs, acl) for ansible and maintenance automations on the fedora host. LLM-Generated: true
2026-10-12 10:31:36 -04:00
parent be7a4cf0ce
commit d9925b931d
1 changed files with 59 additions and 0 deletions
@@ -0,0 +1,59 @@
+# This is the sudoers file for the ops user to give limited access to specific commands without a password
+# Used for automations like ansible and maintenance
+
+# Hostname
+ops ALL=(root) NOPASSWD: /usr/bin/hostnamectl hostname *
+
+# Reboot
+ops ALL=(root) NOPASSWD: /usr/bin/reboot
+
+# System updates
+ops ALL=(root) NOPASSWD: /usr/bin/dnf update*, /usr/bin/dnf upgrade*, /usr/bin/dnf install *, /usr/bin/dnf remove *
+
+# Package cache management
+ops ALL=(root) NOPASSWD: /usr/bin/dnf clean all, /usr/bin/dnf makecache, /usr/bin/dnf autoremove
+
+# Repos
+ops ALL=(root) NOPASSWD: /usr/bin/dnf config-manager addrepo *
+
+# Service management
+ops ALL=(root) NOPASSWD: /usr/bin/systemctl start *, /usr/bin/systemctl restart *, /usr/bin/systemctl reload *, /usr/bin/systemctl enable *
+
+# Firewall
+ops ALL=(root) NOPASSWD: /usr/bin/firewall-cmd *
+
+# Ansible
+ops ALL=(root) NOPASSWD: /bin/sh -c echo BECOME-SUCCESS-* ; /usr/bin/python3 /home/ops/.ansible*
+
+# qemu-img
+ops ALL=(root) NOPASSWD: /usr/bin/qemu-img *
+
+# virsh
+ops ALL=(root) NOPASSWD: /usr/bin/virsh *
+
+# virt-install
+ops ALL=(root) NOPASSWD: /usr/bin/virt-install *
+
+# composer-cli
+ops ALL=(root) NOPASSWD: /usr/bin/composer-cli *
+
+# osbuild
+ops ALL=(root) NOPASSWD: /usr/local/bin/osbuild-auto.sh
+
+# getfacl
+ops ALL=(root) NOPASSWD: /usr/sbin/getfacl*
+
+# set default rwx sbin
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /usr/local/sbin
+
+# set existing rwx sbin
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /usr/local/sbin
+
+# set default rwx /srv
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /srv/*
+
+# set existing rwx /srv
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /srv/*
+
+# Start btrfs scrub
+ops ALL=(root) NOPASSWD: /usr/bin/btrfs scrub*